Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2024-11-28 10:18:21 -05:00
Code Issues Projects Releases Wiki Activity

P2P: Check Action frame payload match before accepted TX status

Browse Source 
It is possible for there to be two pending off-channel TX frames, e.g.,
when two devices initiate GO Negotiation at more or less the same time.
This could result in the TX status report for the first frame clearing
wpa_s->pending_action_tx that included the newer frame that has not yet
been transmitted (i.e., is waiting to be sent out). Avoid losing that
frame by confirming that the TX status payload matches the pending frame
before clearing the pending frame and reporting the TX status callback.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Po-Lun Lai 2013-10-23 13:16:31 +03:00 committed by Jouni Malinen
parent d259249762
commit 47d986e6ff
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
wpa_supplicant/offchannel.c
View File

@ -159,6 +159,21 @@ void offchannel_send_action_tx_status(
return;
}
/* Accept report only if the contents of the frame matches */
if (data_len - wpabuf_len(wpa_s->pending_action_tx) != 24 ||
os_memcmp(data + 24, wpabuf_head(wpa_s->pending_action_tx),
wpabuf_len(wpa_s->pending_action_tx)) != 0) {
wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - "
"mismatching contents with pending frame");
wpa_hexdump(MSG_MSGDUMP, "TX status frame data",
data, data_len);
wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame",
wpa_s->pending_action_tx);
return;
}
wpa_printf(MSG_DEBUG, "Off-channel: Delete matching pending action frame");
wpabuf_free(wpa_s->pending_action_tx);
wpa_s->pending_action_tx = NULL;